---
title: oras backup
sidebar_position: 20
warning: Do NOT modify this generated file
---

# oras backup

[Experimental] Back up artifacts from a registry into an OCI image layout, saved either as a directory or a tar archive.
The output format is determined by the file extension of the specified output path: if it ends with ".tar", the output will be a tar archive; otherwise, it will be a directory.

```bash
oras backup [flags] --output <path> <registry>/<repository>[:<ref1>[,<ref2>...]]
```

## Examples

Back up a single artifact to a directory:

```bash
oras backup --output hello localhost:5000/hello:v1
```

Back up to a tar archive:

```bash
oras backup --output hello.tar localhost:5000/hello:v1
```

Back up an artifact along with its referrers (e.g. attestations, SBOMs):

```bash
oras backup --output hello --include-referrers localhost:5000/hello:v1
```

Back up multiple specific tags:

```bash
oras backup --output hello localhost:5000/hello:v1,v2,v3
```

Back up all tagged artifacts in a repository:

```bash
oras backup --output hello localhost:5000/hello
```

Use Referrers API for discovering referrers:

```bash
oras backup --output hello --include-referrers --distribution-spec v1.1-referrers-api localhost:5000/hello:v1
```

Use Referrers Tag Schema for discovering referrers:

```bash
oras backup --output hello --include-referrers --distribution-spec v1.1-referrers-tag localhost:5000/hello:v1
```

Back up from an insecure registry:

```bash
oras backup --output hello --insecure localhost:5000/hello:v1
```

Back up from a registry using plain HTTP (no TLS):

```bash
oras backup --output hello --plain-http localhost:5000/hello:v1
```

Set custom concurrency level:

```bash
oras backup --output hello --concurrency 6 localhost:5000/hello:v1
```

## Options

```
      --ca-file string                             server certificate authority file for the remote registry
      --cert-file string                           client certificate file for the remote registry
      --concurrency int                            concurrency level (default 3)
  -d, --debug                                      output debug logs (implies --no-tty)
      --distribution-spec string                   [Preview] set OCI distribution spec version and API option for target. Options: v1.1-referrers-tag, v1.1-referrers-api
  -H, --header stringArray                         add custom headers to requests
  -h, --help                                       help for backup
      --identity-token string                      registry identity token
      --identity-token-stdin                       read identity token from stdin
      --include-referrers                          back up the artifact with its referrers (e.g., attestations, SBOMs)
      --insecure                                   allow connections to SSL registry without certs
      --key-file string                            client private key file for the remote registry
      --no-tty                                     [Preview] disable progress bars
  -o, --output string                              path to the target output, either a tar archive (*.tar) or a directory
  -p, --password string                            registry password or identity token
      --password-stdin                             read password from stdin
      --plain-http                                 allow insecure connections to registry without SSL check
      --registry-config path                       path of the authentication file for registry
      --resolve host:port:address[:address_port]   customized DNS for registry, formatted in host:port:address[:address_port]
  -u, --username string                            registry username
```
